CI/CD and Security: the two concepts most PMs skip
Continuous Integration and Continuous Deployment determine how fast a fix reaches users. Security basics determine whether your product can be shipped at all. Both require PM input in the spec, not just engineering attention in the build.
API Types: When to Use Which
You will not choose the API type. You will influence the decision by asking the right question about your product's needs.
| API Type | How It Works | Best Used When | PM Implication |
|---|---|---|---|
| REST | Fixed endpoints return fixed data shapes | Standard data retrieval, public APIs, broad ecosystem support | Most common. Simple to understand and integrate. The default unless there is a specific reason otherwise. |
| GraphQL | Client specifies exactly what data it needs | Mobile apps where bandwidth matters, complex data with many entity types | Reduces over-fetching and improves performance on mobile. Requires a more complex backend implementation. |
| gRPC | Binary protocol, strongly typed contracts | Internal service-to-service communication, high-performance requirements | Rarely specified by PMs directly. Relevant when engineering discusses internal service latency. |
| Webhooks | Server pushes data to your app on event | Real-time notifications, payment confirmations, event-driven workflows | Ask: does the third party support webhooks, or will we poll? Polling at scale is expensive and unreliable. |